State-backed hackers are exploiting new Ivanti VPN zero-days — but no patches yet

Ivanti has confirmed active exploitation of two critical zero-day flaws in its Connect Secure VPN appliances that allow unauthenticated remote code execution; vendor patches are delayed while CISA and researchers urge immediate mitigations. Volexity links observed intrusions to a China-backed group (UTA0178) and notes potential compromises dating to early December, and scans suggest roughly 15,000 internet-exposed appliances may be vulnerable, increasing the risk of widespread impact.